CVE-2026-50874: OS Command Injection in kanishka-linux Reminiscence 0.3.0

Technical summary

CVE-2026-50874 is a CWE-78 OS command injection vulnerability located in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0. The vulnerability stems from insufficient input validation and sanitization of user-supplied parameters before passing them to system command execution functions. The CVSS v3.1 score of 8.1 (HIGH) reflects a network-accessible attack vector, low attack complexity, and requirement for low privileges (authenticated access), resulting in high impact to confidentiality and integrity with no availability impact.

Business impact

Compromise of a vulnerable Reminiscence instance enables attackers to execute arbitrary commands within the server environment, potentially leading to data exfiltration, lateral movement within the network, installation of persistence mechanisms, or modification of application logic. For organizations relying on Reminiscence for media management workflows, this vulnerability could disrupt operations, compromise sensitive media assets, and create compliance violations if personal or regulated data is exposed.

Affected systems

kanishka-linux Reminiscence version 0.3.0 is confirmed affected. Organizations using this version in production environments with network-accessible deployment should prioritize assessment and patching. Verify your installed version via application settings or administrative panels.

Exploitability

The vulnerability requires authentication, which reduces immediate risk from unauthenticated internet scanning. However, the attack complexity is low—once an attacker gains valid credentials (through compromise, insider threat, or credential theft), exploiting the flaw requires only crafting a standard HTTP request with malicious input. No user interaction or complex environmental conditions are required, making exploitation straightforward for a motivated adversary with account access.

Remediation

Upgrade kanishka-linux Reminiscence to a patched version released after June 15, 2026. Consult the official kanishka-linux security advisories and release notes for the specific patch version addressing CVE-2026-50874. Until patching is possible, restrict network access to the /manage/features/media endpoint via network segmentation, firewall rules, or reverse proxy authentication controls to limit exposure to trusted administrative networks only.

Patch guidance

Check the kanishka-linux project repository or security advisories page for version releases issued after the vulnerability publication date of June 15, 2026. Apply the latest patched version to all production instances. After patching, restart the application and validate that the media management feature functions correctly. Test in a non-production environment first to ensure compatibility with your deployment.

Detection guidance

Monitor application logs for suspicious requests to the /manage/features/media endpoint, particularly those containing shell metacharacters (|, ;, &, $, backticks, etc.) in parameter values. Web application firewalls (WAF) should be configured to block payloads containing common command injection patterns. Implement authentication logging to track which users access the media management interface and from which IP addresses. Network-level monitoring for unusual process spawning from the application process can also indicate exploitation attempts.

Why prioritize this

Despite the requirement for authentication, the HIGH CVSS severity, wide attack surface (network-accessible endpoint), low attack complexity, and potential for complete system compromise warrant urgent remediation. The confidentiality and integrity impacts are severe, and the vulnerability likely affects a component frequently accessed by administrators, increasing real-world risk.

Risk score, explained

CVSS v3.1 score of 8.1 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for authenticated privileges (PR:L), no scope change (S:U), high confidentiality impact (C:H), high integrity impact (I:H), and no availability impact (A:N). The HIGH severity designation is appropriate given the combination of ease of exploitation and severe impact once a valid account is obtained or compromised.

Frequently asked questions